public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/java-latest-openjdk-portable] epel10.2: Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown
@ 2026-07-24 16:24 Jiri Vanek
0 siblings, 0 replies; only message in thread
From: Jiri Vanek @ 2026-07-24 16:24 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/java-latest-openjdk-portable
Branch : epel10.2
Commit : f4b1b65aedae45624a4a0cceab34fc2ec282c4e0
Author : Jiri Vanek <jvanek@redhat.com>
Date : 2026-03-25T18:50:31+01:00
Stats : +92/-126 in 3 file(s)
URL : https://src.fedoraproject.org/rpms/java-latest-openjdk-portable/c/f4b1b65aedae45624a4a0cceab34fc2ec282c4e0?branch=epel10.2
Log:
Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown
- Fix FIPS issue list to represent the new 25u version
- Resolves: OPENJDK-4570
---
diff --git a/fips-25u-df044414ef4.patch b/fips-25u-df044414ef4.patch
deleted file mode 100644
index 8b210e6..0000000
--- a/fips-25u-df044414ef4.patch
+++ /dev/null
@@ -1,92 +0,0 @@
-diff --git a/src/java.base/share/classes/java/security/Provider.java b/src/java.base/share/classes/java/security/Provider.java
-index de2845fb550..b1e416b90f4 100644
---- a/src/java.base/share/classes/java/security/Provider.java
-+++ b/src/java.base/share/classes/java/security/Provider.java
-@@ -1203,6 +1203,39 @@ public Set<Service> getServices() {
- return serviceSet;
- }
-
-+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvvvv */
-+ private static final class RedHatFIPSFilter {
-+ static final boolean IS_ON = Boolean.parseBoolean(
-+ Security.getProperty("__redhat_fips_filter__"));
-+ private static final Set<String> ANY_SERVICE_TYPE = Set.of();
-+ private static final Map<String, Set<String>> ALLOW_LIST = Map.of(
-+ "SunPKCS11-FIPS", ANY_SERVICE_TYPE,
-+ "SUN", Set.of(
-+ "AlgorithmParameterGenerator",
-+ "AlgorithmParameters", "CertificateFactory",
-+ "CertPathBuilder", "CertPathValidator", "CertStore",
-+ "Configuration", "KeyStore"),
-+ "SunEC", Set.of(
-+ "AlgorithmParameters", "KeyFactory"),
-+ "SunJSSE", ANY_SERVICE_TYPE,
-+ "SunJCE", Set.of(
-+ "AlgorithmParameters",
-+ "AlgorithmParameterGenerator", "KeyFactory",
-+ "SecretKeyFactory"),
-+ "SunRsaSign", Set.of(
-+ "KeyFactory", "AlgorithmParameters"),
-+ "XMLDSig", ANY_SERVICE_TYPE
-+ );
-+
-+ static boolean isAllowed(String provName, String serviceType) {
-+ Set<String> allowedServiceTypes = ALLOW_LIST.get(provName);
-+ return allowedServiceTypes != null &&
-+ (allowedServiceTypes == ANY_SERVICE_TYPE ||
-+ allowedServiceTypes.contains(serviceType));
-+ }
-+ }
-+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
-+
- /**
- * Add a service. If a service of the same type with the same algorithm
- * name exists, and it was added using {@link #putService putService()},
-@@ -1231,6 +1264,15 @@ protected void putService(Service s) {
- ("service.getProvider() must match this Provider object");
- }
- String type = s.getType();
-+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
-+ if (RedHatFIPSFilter.IS_ON && !RedHatFIPSFilter.isAllowed(name, type)) {
-+ if (debug != null) {
-+ debug.println("The previous " + name + ".putService() call " +
-+ "was skipped by " + RedHatFIPSFilter.class.getName());
-+ }
-+ return;
-+ }
-+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
- String algorithm = s.getAlgorithm();
- ServiceKey key = new ServiceKey(type, algorithm, true);
- implRemoveService(serviceMap.get(key));
-diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java
-index 6969fe8a8e1..4501d5971c4 100644
---- a/src/java.base/share/classes/java/security/Security.java
-+++ b/src/java.base/share/classes/java/security/Security.java
-@@ -323,7 +323,27 @@ public Properties getInitialProperties() {
- }
-
- private static void initialize() {
-+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
-+ /* This 'include'-directives-only magic property is an internal */
-+ /* implementation detail that could (and probably will!) change. */
-+ /* Red Hat customers should NOT rely on this for their own use. */
-+ String fipsKernelFlag = "/proc/sys/crypto/fips_enabled";
-+ boolean fipsModeOn;
-+ try (InputStream is = new java.io.FileInputStream(fipsKernelFlag)) {
-+ fipsModeOn = is.read() == '1';
-+ } catch (IOException ioe) {
-+ fipsModeOn = false;
-+ if (sdebug != null) {
-+ sdebug.println("Failed to read FIPS kernel file: " + ioe);
-+ }
-+ }
-+ String fipsMagicPropName = "__redhat_fips__";
-+ System.setProperty(fipsMagicPropName, "" + fipsModeOn);
-+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
- SecPropLoader.loadAll();
-+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
-+ System.clearProperty(fipsMagicPropName);
-+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
- initialSecurityProperties = (Properties) props.clone();
- if (sdebug != null) {
- for (String key : props.stringPropertyNames()) {
diff --git a/fips-25u-e55ada9353e.patch b/fips-25u-e55ada9353e.patch
new file mode 100644
index 0000000..69e2dad
--- /dev/null
+++ b/fips-25u-e55ada9353e.patch
@@ -0,0 +1,87 @@
+diff --git a/src/java.base/share/classes/java/security/Provider.java b/src/java.base/share/classes/java/security/Provider.java
+index de2845fb550..60eeab678ca 100644
+--- a/src/java.base/share/classes/java/security/Provider.java
++++ b/src/java.base/share/classes/java/security/Provider.java
+@@ -1203,6 +1203,34 @@ public Service getService(String type, String algorithm) {
+ return serviceSet;
+ }
+
++ /* vvvvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvvvv */
++ private static final class RedHatFIPSFilter {
++ static final boolean IS_ON = Boolean.parseBoolean(
++ Security.getProperty("__redhat_fips_filter__"));
++ private static final Map<String, Set<String>> ALLOW_LIST = Map.of(
++ "SUN", Set.of(
++ "AlgorithmParameterGenerator",
++ "AlgorithmParameters", "CertificateFactory",
++ "CertPathBuilder", "CertPathValidator", "CertStore",
++ "Configuration", "KeyStore"),
++ "SunEC", Set.of(
++ "AlgorithmParameters", "KeyFactory"),
++ "SunJCE", Set.of(
++ "AlgorithmParameters",
++ "AlgorithmParameterGenerator", "KeyFactory",
++ "SecretKeyFactory"),
++ "SunRsaSign", Set.of(
++ "KeyFactory", "AlgorithmParameters")
++ );
++
++ static boolean isAllowed(String provName, String serviceType) {
++ Set<String> allowedServiceTypes = ALLOW_LIST.get(provName);
++ return allowedServiceTypes == null ||
++ allowedServiceTypes.contains(serviceType);
++ }
++ }
++ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
++
+ /**
+ * Add a service. If a service of the same type with the same algorithm
+ * name exists, and it was added using {@link #putService putService()},
+@@ -1231,6 +1259,15 @@ protected void putService(Service s) {
+ ("service.getProvider() must match this Provider object");
+ }
+ String type = s.getType();
++ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
++ if (RedHatFIPSFilter.IS_ON && !RedHatFIPSFilter.isAllowed(name, type)) {
++ if (debug != null) {
++ debug.println("The previous " + name + ".putService() call " +
++ "was skipped by " + RedHatFIPSFilter.class.getName());
++ }
++ return;
++ }
++ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
+ String algorithm = s.getAlgorithm();
+ ServiceKey key = new ServiceKey(type, algorithm, true);
+ implRemoveService(serviceMap.get(key));
+diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java
+index 6969fe8a8e1..4501d5971c4 100644
+--- a/src/java.base/share/classes/java/security/Security.java
++++ b/src/java.base/share/classes/java/security/Security.java
+@@ -323,7 +323,27 @@ public Properties getInitialProperties() {
+ }
+
+ private static void initialize() {
++ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
++ /* This 'include'-directives-only magic property is an internal */
++ /* implementation detail that could (and probably will!) change. */
++ /* Red Hat customers should NOT rely on this for their own use. */
++ String fipsKernelFlag = "/proc/sys/crypto/fips_enabled";
++ boolean fipsModeOn;
++ try (InputStream is = new java.io.FileInputStream(fipsKernelFlag)) {
++ fipsModeOn = is.read() == '1';
++ } catch (IOException ioe) {
++ fipsModeOn = false;
++ if (sdebug != null) {
++ sdebug.println("Failed to read FIPS kernel file: " + ioe);
++ }
++ }
++ String fipsMagicPropName = "__redhat_fips__";
++ System.setProperty(fipsMagicPropName, "" + fipsModeOn);
++ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
+ SecPropLoader.loadAll();
++ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
++ System.clearProperty(fipsMagicPropName);
++ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
+ initialSecurityProperties = (Properties) props.clone();
+ if (sdebug != null) {
+ for (String key : props.stringPropertyNames()) {
diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec
index 383730f..9401532 100644
--- a/java-latest-openjdk-portable.spec
+++ b/java-latest-openjdk-portable.spec
@@ -446,7 +446,7 @@ exit 1
# Define IcedTea version used for SystemTap tapsets and desktop file
%global icedteaver 6.0.0pre00-c848b93a8598
# Define current Git revision for the FIPS support patches
-%global fipsver df044414ef4
+%global fipsver e55ada9353e
# Define JDK versions
%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
%global javaver %{featurever}
@@ -461,7 +461,7 @@ exit 1
%global top_level_dir_name %{vcstag}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 35
-%global rpmrelease 1
+%global rpmrelease 2
#%%global tagsuffix %%{nil}
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
%if %is_system_jdk
@@ -743,38 +743,9 @@ Source18: TestTranslations.java
# The following list is generated by:
# git log %%{vcstag}.. --no-merges --format=%s --reverse:
# Fixes currently included:
-# PR3183, RH1340845: Follow system wide crypto policy
-# PR3695: Allow use of system crypto policy to be disabled by the user
-# RH1655466: Support RHEL FIPS mode using SunPKCS11 provider
-# RH1818909: No ciphersuites availale for SSLSocket in FIPS mode
-# RH1860986: Disable TLSv1.3 with the NSS-FIPS provider until PKCS#11 v3.0 support is available
-# RH1915071: Always initialise JavaSecuritySystemConfiguratorAccess
-# RH1929465: Improve system FIPS detection
-# RH1995150: Disable non-FIPS crypto in SUN and SunEC security providers
-# RH1996182: Login to the NSS software token in FIPS mode
-# RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to false
-# RH2021263: Resolve outstanding FIPS issues
-# RH2052819: Fix FIPS reliance on crypto policies
-# RH2052829: Detect NSS at Runtime for FIPS detection
-# RH2052070: Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode
-# RH2023467: Enable FIPS keys export
-# RH2094027: SunEC runtime permission for FIPS
-# RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
-# RH2090378: Revert to disabling system security properties and FIPS mode support together
-# RH2104724: Avoid import/export of DH private keys
-# RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
-# Build the systemconf library on all platforms
-# RH2048582: Support PKCS#12 keystores [now part of JDK-8301553 upstream]
-# RH2020290: Support TLS 1.3 in FIPS mode
-# Add nss.fips.cfg support to OpenJDK tree
-# RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode
-# Remove forgotten dead code from RH2020290 and RH2104724
-# OJ1357: Fix issue on FIPS with a SecurityManager in place
-# RH2134669: Add missing attributes when registering services in FIPS mode.
-# test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
-# RH1940064: Enable XML Signature provider in FIPS mode
-# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream]
-# usage in jdk >25 is experimental and may disapear
+# OPENJDK-2108: Internal __redhat_fips__ property
+# OPENJDK-2123: Algorithms lockdown
+# OPENJDK-4559: Red Hat Build of OpenJDK 25 should not restrict all the providers in FIPS
Patch1001: fips-25u-%{fipsver}.patch
#############################################
^ permalink raw reply related [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-24 16:24 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-07-24 16:24 [rpms/java-latest-openjdk-portable] epel10.2: Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown Jiri Vanek
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox